Automatically applying components based on crash stacktrace and information from OWNERS files.

If this is incorrect, please apply the Test-Predator-Wrong-Components label.

Automatically assigning owner based on suspected regression changelist https://chromium.googlesource.com/chromium/src/+/e700f0736c3877f360df459451da28db019fc321 ([bindings] Attach after setting the listener object).

If this is incorrect, please let us know why and apply the Test-Predator-Wrong-CLs label. If you aren't the correct owner for this issue, please unassign yourself as soon as possible so it can be re-triaged.

Currently building and checking which cast is off this time.

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/9116462178e376500e31f312f1903b14314a7b35

commit 9116462178e376500e31f312f1903b14314a7b35
Author: Michael Lippautz <mlippautz@chromium.org>
Date: Fri Aug 03 11:23:48 2018

[bindings] Fix cast for GetEventListener

Previously, only V8EventListener were handled in the helper. With
crrev.com/579347 this changed and all types of V8 event listeners use
this mechanism. Their common superclass is V8AbstractEventListener which
is returned here.

Bug:  chromium:870351 , chromium:843903
Change-Id: I4407cf5abfddf10d644c3fd7e1add86dbfa5d5f9
Reviewed-on: https://chromium-review.googlesource.com/1161907
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Yuki Shiino <yukishiino@chromium.org>
Reviewed-by: Yuki Shiino <yukishiino@chromium.org>
Cr-Commit-Position: refs/heads/master@{#580505}
[modify] https://crrev.com/9116462178e376500e31f312f1903b14314a7b35/third_party/blink/renderer/bindings/core/v8/v8_event_listener_helper.cc
[modify] https://crrev.com/9116462178e376500e31f312f1903b14314a7b35/third_party/blink/renderer/bindings/core/v8/v8_event_listener_helper.h

ClusterFuzz has detected this issue as fixed in range 580504:580505.

Detailed report: https://clusterfuzz.com/testcase?key=6160882766446592

Fuzzer: inferno_webbot
Job Type: linux_ubsan_vptr_chrome
Platform Id: linux

Crash Type: Bad-cast
Crash Address: 0x0f0f4d461e88
Crash State:
  Bad-cast to blink::V8EventListener from blink::V8LazyEventListener
  blink::V8EventListenerHelper::GetEventListener
  blink::V8EventTarget::addEventListenerMethodCallback
  
Sanitizer: undefined (UBSAN)

Recommended Security Severity: High

Regressed: https://clusterfuzz.com/revisions?job=linux_ubsan_vptr_chrome&range=579346:579347
Fixed: https://clusterfuzz.com/revisions?job=linux_ubsan_vptr_chrome&range=580504:580505

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6160882766446592

See https://github.com/google/clusterfuzz-tools for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz testcase 6160882766446592 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot